REMARKS 

Claims 1-41 are pending in the application and stand rejected under 35 U.S.C. § 102(e) as 
being anticipated by U.S. Patent Publication No. 2003/008877 to Merchen . Applicants 
respectfully traverse the rejection and contend that at the very least Merchen does not anticipate 
the subject matter of claims 1, 21, 36 or 40. 

On a fundamental level, the teachings of Merchen are different and essentially irrelevant 
within the context of the subject matter of the claimed inventions. Indeed, Merchen is generally 
directed to methods for authorizing electronic data transfers using digital certificate techniques, 
namely, methods for creating non-repudiated digital receipts and electron signatures for 
electronic transactions (See Merchen Abstract) 

In contrast, the subject matters of the claimed inventions are generally directed to 
methods for "de-identifying" data records of individuals by removing information that relates to 
the identity of the individual to generate de-identified data records, and then creating encrypted 
IDs that are associated with the de-identified data records and which allow the patient identity 
information to be recovered. By way of example, as discussed in the background section of 
Applicants specification, in the context of medical data records and the HIPPAA Privacy Rule, 
certain entities are allowed to "de-identify" protected health information for certain purposes so 
that such information may be used and disclosed freely, without being subject to the protections 
afforded by the Privacy Rule. The term "de-identified data" as used by HIPAA refers to patient 
data from which all information that could reasonably be used to identify the patient has been 
removed (e.g., removing name, address, social security numbers, etc). Although the patient data 
records are de-identified, there is no mechanism by which patient identification can be recovered, 
if necessary. 

In view of the above, it is respectfully submitted that at the very least, Merchen does not 
anticipate or render obvious the subject matters of claims 1 , 2 1 , 36 or 40. In formulating the 
rejections of independent claims 1,21,36 and 40, the Examiner provides a very general, omnibus 
rejection that simply cites paragraphs [0089], [0081] and {0098} of Merchen as disclosing 
subject matters of claims 1, 21, 36 and 40, while offering no supporting explanation . However, 
the basis for the Examiner's rejection is unclear and seemingly unfounded giving that the cited 
sections of Merchen are essentially irrelevant, and clearly do not disclose, the subject matters of 
the claims. 

For instance, with regard to claim 1, Merchen does not disclose in paragraph [0089] a 
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claimed feature of removing patient identifying information in the patient data record to 
generate a de-identified data record, as contended on page 2 of the Office Action. In the context 
of the claimed inventions, generating a "de-identified" data record comprised removing (purging 
patient identifying information from the data record, such as removing information that can be 
used to identify the patient of the patient data records , such as name, zip codes, birth dates, etc. 
(see pages 23-24 of Applicants' specification, for example). 

Merchen generally discloses in paragraph [0089] that privacy and secrecy of patient 
information is made possible by incorporating encrypting and hashing techniques. This has 
nothing to do with, and clearly does not explicity teach, the process of "generating a de-identified 
data record" in the context of the claimed inventions. In fact, Merchen generally teaches a 
process (paragraphs [0089-0098]} to support electronic data transfers (e.g., electronic 
prescriptions) whereby a Doctor can use a personal digital certificate to send an encrypted 
electronic prescription to a Pharmacist who may access and decrypt the electronically transferred, 
encrypted e-prescription using a valid unique digital certificate (see Para. [0098]) Merchen 
teaches that the pharmacist would not be allowed to view the prescription if his/her digital 
certificate is revoked (see Para. [0095]). 

It should be glaringly apparent that the cited sections have no relation to the claimed 
process of removing patient identifying information in the patient data record to generate a 
de-identified data record, within the context of the claimed inventions. Indeed, Merchen teaches 
nothing more than a process of maintaining privacy by simply encrypting an entire electronic file 
containing patient information for electronic transfer and storage such that only a valid digital 
certificate holder can access and review the contents of the file (including patient identifying 
information). 

On the other hand, a "de-identified" data record is a data record purges of patient 
identifying information, but still contains readable and accessible non-patient identifying 
information that is freely viewable and readable by any person. In the context of the standards of 
the HIPPAA, protected health information that is "de-identified" may be used and disclosed 
freely, without being subject to the protections afforded by the Privacy Rule (see, Background of 
Applicants Specification). 

Furthermore, it should be fundamentally clear that Merchen does not disclose or suggest 
generating an encrypted ID for the patient, wherein the encrypted ID comprises an encrypted 
representation of one or more items of patient identifying information, much less storing the 
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encrypted ID with or in the de-identified data record, as recited in claim 1, for example. Indeed, 
it is respectfully submitted that the Examiner's reliance on paragraphs [0081 and 0098] of 
Merchen as disclosing the above claim features, is misplaced. 

Again, Merchen teaches nothing more than a process of encrypting an electronic file of 
patient information , in its entirety , and allowing access to the file only by a holder of a valid 
digital certificate. Merchen simply does not disclose in the cited sections a process of creating an 
encrypted ID using one or more of the items of patient identifying information, and storing the 
encrypted ID with or in the de-identified data record. Indeed, in the context of the claimed 
inventions, the de-identified data record can be freely accessible and viewable without being 
decrypted, while the encrypted ID that is associated with the de-identified data record is not 
accessible or viewable without being decrypted by an authorized individual This process has an 
advantage of allowing the non-patient identifying information to be freely accessible while 
maintaining patient identification privacy, while allowing a authorized entity or individual to 
recover the identify of the patient associated with the "de-identified" data record when necessary. 
These fundamental concepts are not disclosed or suggested by Merchen 

Accordingly, claim 1 is patentably distinct and patentable over Merchen . Moreover, to 
the extent that the rejections of claims 21, 36 and 40 are based on the same rationale for rejection 
claim 1, Applicants assert that claims 21, 36 and 40 are patentably distinct and patentable over 
Merchen for at least the same or similar reasons given above for claim 1 . Moreover, all over 
claims depending from claims 1,21 and 36 are patentably distinct and patentable over Merchen 
at least by virtue of their dependence from respective base claims 1,21 and 36. Accordingly, 
withdrawal of the rejections is requested. 
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